Initia IBC Exploit: $3.27M Stolen via Forged Withdrawals, L1 Paused

The Initia IBC exploit moved about $3.27 million to an attacker’s address, and $2.16 million of that is still stuck on the paused L1, according to the Update on X.

It says no INIT was taken and that it plans to restore the backing of the hit   assets in full.

Key Takeaways

• An attacker got in on November 9 with a leaked cloud key and forged IBC withdrawals from five rollups.

• About $3.27 million moved to the attacker, and $2.16 million is frozen on the paused L1.

• No INIT was withdrawn, and the team plans to restore the assets, but the plan is not final.

• This is the second incident in about three weeks, and each had a different cause.

What Happened in the Initia IBC Exploit?

The team says the attacker used a command injection attack and a leaked Google Cloud key that was used to set up private nodes. That showed hidden settings, which gave the hacker a way into the GitHub and cloud accounts and more login details. 

With those, the hacker reached Anvil, the platform that hosts rollups on the chain.

How Do Forged IBC Withdrawals Work?

IBC is a way for chains to send tokens to each other, and the tokens sit in escrow accounts while they are away from home. The team says the attacker used Anvil to approve fake IBC withdrawals from five rollups, which unlocked the assets held in escrow on the L1. 

In plain words, the system was tricked into paying out money that did not belong to the attacker.

How Much Was Moved and How Much Is Frozen?

About $3.27 million of assets went to the attacker’s address on the L1, and $2.16 million of it cannot move since the L1 is paused. The hacker sold some assets on the Initia DEX and then took out 13.4k TIA, 8k USDC.inj and 597k Noble USDC before hitting the IBC rate limits. The team says the attacker did not withdraw any INIT.

Initia L1 Paused: Recovery Plan and Restart Status

The team plans to restore the backing of the hit assets in full and is still working on the plan. It is also rebuilding the hit systems from scratch in a safe, isolated space, with tighter access rules and stronger checks from the cloud to on-chain IBC. It expects this to take longer than a normal restart and has not given a date.

The Earlier Security Incident on October 23

This is not the first hit in recent weeks. On October 23, the team said an attacker used a bug in the script caching of its MoveVM to get unbacked WETH, iUSD, and USDC without changing token supply, as the October update explains. 

About $2.7 million left the chain before the halt, and no native INIT was minted, so the two events had different causes, a code bug first and a leaked key now.

What Initia Users Should Do Now

After the Initia IBC exploit, follow only the official website and channels for news, since the team says all updates will come from there. Be wary of links in chats and replies, because fake help pages often show up after a hack, and never share your seed phrase. This crypto news report is not advice, so check your own assets and risks.

The Bottom Line

The Initia IBC exploit shows how one leaked cloud key can open the door to a whole chain, and the next things to watch are the recovery plan and a restart date from the official updates.

YMYL Disclaimer: This article is for information only and is not financial or investment advice. Crypto is volatile and carries a risk of loss, so check official sources before you act.